1. Field of the Invention
The present invention is in the technical field of data copying. More particularly, the present invention is in the technical field of data preservation and collection for litigation, investigations, intelligence or other scenarios requiring the preservation or forensic collection of data.
2. Description of Related Art
Forensic data collection is often performed for legal matters in order to preserve and/or analyze data that may be used during criminal or civil litigation. The process of forensic data collection is different from a normal file copy process in that with forensic copying, the version of data that is copied is a mirror image of the original data being copied.
Forensic data collection normally requires that a forensic technician conduct the data collection directly from a user's computer on-site. Forensic technicians use special software that copies the source data exactly, so that the copy is an exact representation of the original data set. Forensic technicians also use a verification method, such as a digital hash, so the data collection can be verified by a third party in case a question arises as to the authenticity of the data during or after analysis. Having a forensic technician perform the copy, however, can be a costly proposition, especially if a legal matter or investigation involves multiple users' computers in multiple locations.
If a forensic technician is not hired to perform the collection, because of cost or other reasons, the user may be asked to make a “normal” copy of their data. This, however, may create problems since the user may, advertently or inadvertently, not copy the correct information from their computer. In addition, since a user is not a forensic technician, they would not normally use forensic copying software for making copies of data. Therefore, the version of the data copied will not exactly match the original data.